Knowbe4 provides security awareness training and related products designed to reduce human-factor security risk through phishing simulations and employee education. The vendor's disclosed vulnerabilities center on its training platform and recur through web-oriented weakness classes including cross-site scripting and open-redirect conditions, which reflect the authentication and user-input handling demands of a SaaS-delivered training application. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Knowbe4 over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-36845MEDIUM The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirecting. The response has a | Apr 20, 2025 | 6.1 | 19 | NO | NO |
CVE-2020-36844MEDIUM The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to a JavaScript URL. | Apr 20, 2025 | 6.1 | 19 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Knowbe4.
Media articles that mention a CVE ID that affects a product developed by Knowbe4 — matched by CVE ID, not by vendor name.